- ORGSEC
- Insider risk and security culture
Insider risk and security culture
For security managers, HR and authorisation officers in organisations under the Security Act, in the defence industry and in other organisations with assets someone may be interested in, and who want to know whether the organisation catches what the clearance does not see.
Why now
It is the organisation that decides whether personnel security works
PST writes in its National Threat Assessment 2026 that foreign intelligence services will again this year try to recruit sources and helpers in Norway, that social media and fake LinkedIn profiles are an established way in, and that recruited insiders in Norwegian organisations may be asked to obtain information about internal conflicts, dissatisfaction and security gaps. It is the organisational-psychological picture of the organisation a foreign service is after, before it is after the documents.
NSM goes further in Risk 2026 and says that weaknesses in personnel security have led to increased risk of insiders and loss of assets, and points to inadequate competence, weak security leadership and poor internal communication about employees' vulnerabilities as causes. NSM's handbook on personnel security from August 2026 puts it into a system: the risk does not arise only when a person has developed an intention to act disloyally, management must build trust between employees and authorisation officers, and the organisation should plan training and awareness every year. We do not replace clearance and authorisation, which are the organisation's and the authorities' responsibility; we measure and develop the part of personnel security that lies in the organisation.
Sources: PST: National Threat Assessment 2026 (Norwegian) · NSM: Risk 2026 (Norwegian) · NSM: Handbook on integrating personnel security in the organisation's security governance (2026, Norwegian)
What we work with
Four conditions that decide
Dissatisfaction and conflict as security information
Perceived unfairness, unresolved conflicts and weak leader support are what a foreign service is looking for, and what the organisation usually knows least about.
Recruitment through social media
Whether employees recognise a contact that begins as a professional question, a job offer or a consulting assignment, and know what to do with it.
Trust between employees and authorisation officers
Whether it is possible to speak up about one's own and others' vulnerabilities without it costing anything, and thereby whether the organisation learns what it needs to know.
Leadership and internal communication
Whether security leadership is exercised in everyday work, and whether those with roles in personnel security know it and have the competence that is needed.
In the ORGSEC assessment
Where the theme lands in the assessment
- Area 05
People and organisation
Security culture, trust, voice and what happens to concerns, measured through anonymous self-reporting by employees.
- Area 01
Security governance
Whether personnel security is integrated into the management system, with documented roles and an annual plan for training and awareness, as NSM recommends.
This is where ORGSEC differs from the rest of the security market: security is the category, organisational psychology is the method. See the six areas →
What we deliver
Assessment, e-learning and talk
Insider risk and security culture
Anonymous self-reporting by employees on trust, voice, leadership and what happens to concerns, measured against NSM's handbook and the security research. Reported per unit, never on individuals. All services →
Security culture and insider risk
For all employees. Recognising an approach, understanding why dissatisfaction and conflict are security information, and knowing how to raise a concern without fear. Covers NSM's recommendation of annual training and awareness. About the subscription →
The risk arises before the intention
Insider risk as organisational psychology – why conflict, dissatisfaction and weak leadership are what a foreign service is looking for.
Talk
The talk within the theme
The risk arises before the intention
Insider risk as organisational psychology – why conflict, dissatisfaction and weak leadership are what a foreign service is looking for.
- Suitable for
- Security managers, HR and authorisation officers, leadership teams in organisations under the Security Act and in the defence industry
- Format
- 45–90 minutes, or a half day with group work. In person or online.
The people
Talk to an expert
Tell us what you need, and we will propose scope and delivery. The assessment is carried out digitally; we recommend, you decide.
- CEO · ExpertiseOle André BråtenSecurity researcher and special adviser in organisational security
- COO · Projects and developmentAnette FalkumProject and innovation manager
